My best solution is to add a field with the folder name:
source="C:\\..\\Logs\\*" | rex field=source ".*[//\\\]+(?<folder>.*)[//\\\]+.[a-zA-Z.0-9]*"
than i can use it for timechart for example:
source="C:\\..\\Logs\\*" | rex field=source ".*[//\\\]+(?<folder>.*)[//\\\]+.[a-zA-Z.0-9]*" | timechart count by folder
... View more